Parity Ethereum clients struggle to sync amid possible attack

On Monday, Parity Technologies received multiple reports that its blockchain client was failing to sync with the Ethereum network, and following an investigation, believed an attack was the source of the disturbance. In response, the blockchain development firm issued a critical security update (in both beta and stable implementations) for Parity Ethereum node operators to protect against the potential breach. As for the nature of the supposed attack, initial GitHub issue submissions stated that Parity nodes were unable to import valid Ethereum blocks. One user suggested the attacker exploited a vulnerability in Parity clients to send node operators blocks with a valid header (“borrowed from another block”) but invalid transactions. Parity nodes would then permanently mark the otherwise correct block header as invalid, which would knock all affected nodes out of sync with the network.

Why it matters:

• Despite the potentially dire situation, the ordeal did show the benefit of having multiple clients with significant user bases. The attack only impacted Parity nodes, while Geth clients (which make up 75% of Ethereum nodes) and the Ethereum network remained largely unaffected. In comparison, most networks, including Bitcoin, have just one dominant (>95% market share) client implementation.
• Parity Technologies was able to release a security patch on short notice. But the company announced a few weeks ago that it is looking to step back as the primary developer of the Parity Ethereum client to focus on building Ethereum competitor, Polkadot. As part of its departure, Parity Technologies aims to transition the client’s ownership over to a DAO (in which one known contributor will be Gnosis). Whereas a single entity can quickly develop and issue a security patch, it will be interesting to see if a group of contributors can reach a consensus as efficiently should a similar scenario arise.